A walk through the Magit interface - <AUTHOR> https://emacsair.me/2017/09/01/magit-walk-through/ <comment><USER3> What truly makes Magit powerful (like many things in Emacs) that it is extremely extensible.

Example:

When I'm ready to commit my changes:

I can spin-off a new branch:

\- If I have an Org-mode task that I'm currently clocked-in, it can check if it contains a ticket number, then query the issue-tracking system and generate a branch name based on the description.

All it takes is pressing two buttons: `b s`, and the rest is done automatically

\- I commit my changes, it can use a template and fill out the details, I just need to add a description. I can even make it so it compliant with git-commit format enforcer like gommit. I can add fields like reported-by, cc, etc. with a single keystroke;

\- If I suddenly find out that I forgot to add something, I don't have to amend, I don't have to modify the commit, I can just stage my change and press `c e` - "extend". It will quietly add it to my previous commit.

\- Using Forge I can create a PR. Once I push the PR, I can trigger a request to issue-tracker that marks the ticket as in "code review"

There are bunch of things that other Git clients can't do* and even when they do it, it's not so easy to extend them to work with different projects, issue- tracking systems, etc.

* e.g. you can select a bunch of files in Dired and see git log pertaining changes only to those files [https://twitter.com/iLemming/status/1193025618742349824](https://twitter.com/iLemming/status/1193025618742349824)

<comment><USER4> > If I suddenly find out that I forgot to add something, I don't have to > amend, I don't have to modify the commit, I can just stage my change and > press `c e` - "extend". It will quietly add it to my previous commit.

Unless I've thoroughly misunderstood you, what you're saying is that "c e" is equivalent to "git commit --amend". This sounds suspiciously like "amend[ing]".

Sure, git's user interface is somewhere between mediocre and abysmal, but it's not really clear to me that "c e" is a vast improvement.

I say this as a former org-mode user and even one-time contributor. Eventually I decided that the sheer number of magic incantations I had to remember to do anything useful wasn't worth it.

<comment><USER5> It's actually `git commit --amend --no-edit`, but yes, it's basically "just" a shortcut. Count the keystrokes, though. If you spend much time working with git it's a huge win.

Of course you could do something similar with shell aliases or reverse search, but then there are other switches and flags that you need occasionally, etc. And it's sooo much more convenient to have everything in one place right in your editor. It's almost unfair how much faster I can get stuff done than folks who don't use it ;)

Magit isn't hype, it's as good as everyone says it is. You just have to try it.

<comment><USER6> If you spend much time with Git, you create aliases.

Not saying that Magit isn't worth it (never used it), but it's not a fair comparison. I don't `git commit --amend --no-edit`: I `git amend` to edit the last commit, `git amend HASH` to edit any commit, `git amend -i` to pick a commit to edit in a searchable list with preview of their content.

<comment><USER5> > git amend HASH

That's 9 characters plus the effort of finding and copy/pasting the hash. With magit it's two characters and you just focus on the hash in question.

> `git amend -i` to pick a commit to edit in a searchable list with preview of > their content

That's cool! Still a lot more typing than with Magit, which also has a searchable list with content previews ;)

I'm happy that you've found ways to optimize your workflow, but seriously, Magit is still faster.

</comment></comment></comment></comment></comment><comment> trey-jones The granularity of staging and unstaging code, combined with the ease of doing things within the text editor that you're already using anyway are really great. I held off using Magit because I thought learning Emacs would be enough by itself, but Magit is intuitive and easy and I really love it. Made my git usage much more efficient within days of starting to use it.

<comment><USER7> Same but one caveat that still bothers me about it is that it's not a scriptable package.

I can't hook a function to automatically git pull changes when I open it because the pull command only works when the buffer is up.

I'm sure there is some magic to set the current buffer, but for me this is not trivial.

Ideally (magit-diff "myfile.py") should be all I need to do.

<comment><USER3> > Same but one caveat that still bothers me about it is that it's not a > scriptable package.

What are you talking about? It's written in Emacs-lisp, the possibilities are virtually limited only by Emacs's capabilities. Explain what you're trying to do, maybe post your problem to emacs.stackexchange, r/emacs. I'm sure people would be able to help you.

</comment></comment></comment><comment><USER8> Don't miss "Staging parts of a hunk", which is Magit's killer feature, IMO. You can easily go through your current diff (from staged) and add/remove single lines from the staged delta.

<comment><USER9> Staging (and committing?) parts of a hunk is cool and I have done this many times myself. However, I am always uncomfortable with it because I am unsure how to incorporate it within the overall workflow. I'd like each commit of mine to at least compile and pass some tests.

<comment><USER10> I agree: what I often want is _stash_ of selective parts, so I can test the current stuff before commit.

<comment><USER11> Magit supports this as well. In fact you can stash the index and working tree separately. Even CLI got cant do that.

</comment></comment></comment></comment><comment><USER12> I make short YouTube videos about Emacs. I've recently done some Magit and Forge related ones [1]. I record what I learnt, so it's far from perfect. Hopefully this helps someone.

[1]: [https://www.youtube.com/watch?v=7ywEgcbaiys&list=PLhXZp00uXB...](https://www.youtube.com/watch?v=7ywEgcbaiys&list=PLhXZp00uXBk4np17N39WvB80zgxlZfVwj&index=18)

</comment><comment><USER13> I love magit. If you deal with a lot of PRs the forge extension is also very nice.

My only beef is the main interface can feel very slow sometimes.

I've learned to start using the functions directly from the M-x command line when I can. Like rather than going to the main magit interface to stage a file, just M-x stage-file. Time to stash? M-x magit-stash, etc. No need to jump to the main magit UI much of the time.

<comment><USER14> It chokes when there are a large number of changes too because it's cycling through all the individual diffs that are initially hidden. I honestly wish there was a sparse mode to keep the initial magit status buffer as minimal as "git status".

<comment><USER11> You can also use `C-g` to interrupt the diffing algorithm if you just want to get to the minimal git status buffer. In fact that is the recommended way to deal with it.

</comment></comment></comment><comment><USER15> Magit is great, I've used it every day for 10 years or something. There's just one thing I haven't got used to:

1\. Stage some stuff

2\. Start writing the commit message

3\. Stage something else

4\. Commit

The content staged at (3) doesn't make it into the commit. This doesn't fit my mental model from the command line: I think of "commit" as transfer all the staged content into a commit.

Initially magit didn't do this, but I know it is intentional, and in fact the magit author has explained to me that it accurately reflects the command line. But I just seem totally unable to get used to it! I might even change it locally.

<comment><USER3> Seems you need to get comfortable with rebasing. Don't think about your commits (especially if you haven't pushed them out) like something carved in stone.

When I work, depending on what I'm doing I either commit often and don't think much about it and then later rebase and group things into meaningful chunks of work, or I just keep committing into a single commit and then at some point break it apart into smaller commits.

Most often though I do try to keep commits nice and clean from the get-go, and very often I want to add something into a commit that's a few hashes away from the HEAD. In that case I would just rebase/modify with autostash option. It will stash everything and get into rebase mode, I'll go into the stash, select things I want to be included in the commit and press `a`, then I continue rebasing, it will modify the commit, un-stash and get me to the point where I was before.

<comment><USER15> Thanks but sorry, you've missed the point of my post. If you have time, please read it again. I'm pointing out that, if you think of C-c C-c in the commit buffer as being "commit", then there's an uncomfortable conclusion: magit doesn't put everything that is currently staged into the commit. Instead what magit does is freeze the contents of the commit when you open the commit message composition buffer, so anything staged subsequently doesn't make it into the commit.

(In my original message I do say i've been using magit daily for 10 years; i'm extremely familiar with all the rebasing operations you mention. i agree they're very useful and i use them multiple times a day.)

<comment><USER3> No, I think I get what you want the first time I read it. So I did a little experiment (just to make sure I'm not wrong about it). I did everything in the command line. I staged a file, then run git commit, when it opened the editor, I switched to another terminal window and staged another file. Then I switched back and finished committing. And surely enough, just as I expected - git did not commit two files, but only one and the other stayed staged.

So the feature you're asking is not even supported by Git.

And the reason you want that feature, because Magit has spoiled you - <USER2> almost everything is nonlinear (unlike with git cmd), you want to extend it even further. Let's be pragmatic, don't complain that it is great that Tesla has autopilot option but you actually wanted it to be an amphibious vehicle, because you live next to a lake.

<comment><USER15> Right, exactly. What you describe makes sense and is the reason why magit does what it does.

Now, note that you ran `git commit`, with no arguments. Let's think about an alternative narrative on the command line, involving `git commit -m "$message"`

1\. Stage a file.

2\. Start drafting your commit message.

3\. Stage another file.

4\. Finish drafting your commit message.

5\. Issue git commit -m "$message"

This time, both files make it into the commit.

So basically, we are now thinking of the Magit commit composition buffer as a place where you draft a work-in-progress commit message.

I think we can both agree that the idea of having a place where you can draft your commit message, and meanwhile alter the contents of the staging area, is not unreasonable. Perhaps as an alternative to the standard flow.

So my question to you (and those who might consider working on magit code) is: what advantages does the other model have? (other than it mirroring `git commit` with no arguments). Would one ever really want to mess about with the contents of the staging buffer while you have a pending commit message that you have not yet actually committed? Isn't it in fact more likely that what you want to do, while that commit message is pending, is _alter_ the details of what will be committed?

<comment><USER3> Sorry, the "problem" you have is just too alien to me personally. I never had any issues with that feature of Magit, never thought about it until now. Maybe there are people just like you who'd say it's important to them - I can't relate, once again: my apologies.

I'm sure this can be "fixed" by writing some non-trivial Emacs lisp by tapping into `with-editor-finish` or `magit-commit` functions. But honestly, is that worth your time?

Emacs is weird, it makes you want weird things. So many times I would find myself irritated by "an issue" that I just stumbled on, I would write some emacs lips to fix the problem (just because I can), only later to realize there's no problem to begin with.

<comment><USER15> There's no need to apologize! It's just two different possibilities for the design of Magit. I already wrote the code this morning to do this as a quick hack. It's just a few lines and I've been writing lots of emacs lisp recently, so it didn't cost me much time. The question is whether it would be useful as a setting for other magit users. Like I say, I can see arguments for this (being able to update you commit in conjunction with working on the commit message) but neither of us have suggested an advantage of the other model yet.

      (defun myrmornis--magit-commit-staged ()
        (interactive)
        (let ((commit-message (buffer-string)))
          (let ((with-editor-cancel-message ""))
            (with-editor-cancel nil))
          (with-temp-buffer
            (insert commit-message)
            (goto-char (point-min))
            (delete-matching-lines "^[ \t]*#") ;; hack
            (magit-run-git-with-input "commit" "-F" "-")))
        (magit-refresh-all))

      (use-package magit
        :bind (:map with-editor-mode-map
               ("C-c C-c" . myrmornis--magit-commit-staged))

<comment><USER3> I apologized so it is clear that I'm not rejecting your idea due to my shallow thinking. Maybe you are trying to convey a story that potentially opens wide- range of possibilities and I just don't see it.

As I said, maybe there are people who'd find it extremely useful. Would you mind sharing your "hack" in [https://github.com/magit/magit](https://github.com/magit/magit) or [https://gitter.im/magit/magit](https://gitter.im/magit/magit) ?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I have only briefly used Magic, but after reading your article, I am committed. Thanks!

<comment><USER17> probably only "staged" at this point

</comment></comment><comment><USER18> Magit is amazing. When I use cmd line git now, I feel like a lesser primate.

</comment><comment><USER19> Very nice article. I was distracted by mentioning themes right at the beginning, though.

</comment><comment><USER15> I still use the command line for log and show since they are slower in magit, and this is noticeable in large repos.

<comment><USER3> Do you limit number of commits? I set mine to 250, and even that is too big of a number, I usually don't need to see that many commits at once. By not doing it in Magit, you're missing many benefits.

Examples: [https://twitter.com/iLemming/status/1193025618742349824](https://twitter.com/iLemming/status/1193025618742349824) [https://twitter.com/iLemming/status/1058507342830923776](https://twitter.com/iLemming/status/1058507342830923776)

Also you can run any arbitrary git command from Magit dispatch, just press `!`</comment></comment>


Companion – Never walk home alone (pre-launch) - <AUTHOR> http://companionapp.io/

<comment><USER2> "Show HN" in titles is for things that can be tried out now: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html).</comment>


Why you suck as web designer - <AUTHOR> http://alexsblog.org/2014/10/31/why-you-suck-as-web-designer/

<comment><USER2> Choosing a challenging title like this in a blog where my eyes hurt from reading the font, is, well, risky. I'm no designer, and my eyes literally hurt, or to say it in other words, I'm not talking about taste here, but usability.

</comment><comment><USER3> This article implies that programming is not design.. of which i take offense.

<comment><USER2> Why? Making something look good and usable is quite different from writing interfaces and structuring code. Programming not being design doesn't necessarily mean that programming and design can not have some kind of common skill set.</comment></comment>


Review My App: Zen - <AUTHOR>

We just launched Zen, a lightweight, web-based project management tool geared towards startups and small teams that are interested in adopting a lean mindset. We've been in private beta for awhile now, but just opened to the public this morning.
Check it out and let us know what you think! I'm interested in any and all feedback.
http://agilezen.com/?r=hn <comment><USER2> Signed up for a free account: the hint display blocks the bottom part of the add-story sidebar, which makes things more difficult to work with.

A way to get hints back after hiding them would be useful, too. Or some sort of way to summon contextual help. After hiding the hint to get it out of my way, I found I didn't know what "Size" meant, and wasn't immediately sure of where to look.

By the way, I'm currently using pivotal tracker (which has the nice advantage of being free, for some reason), so that's my baseline for comparison.

Minor annoyance: the names next to the « or » should be clickable also, the «» are too small as click targets, so dismissing a sidebar requires more care than it should.

Pivotal gives you an ability to assign FPs to estimate stories, while Zen strongly encourages that you try to make your stories equally sized. I think I like your approach better, since I know I tend to avoid large stories — I need to break it down first before I can work on it without being frightened of it.

There seems to be a bug with trying to edit a story owner while the backlog is open (maybe applies to other sidebars as well, didn't check). When I click the name, it disappears, then if I close the sidebar, the form shows up. If I click on multiple stories while the bar is open, I only get the form on one of them, and have to refresh the page to see the owners again. This is in Safari 4, didn't check other browsers.

It would be nice if stories could be left unassigned in the backlog (perhaps this is meant to be possible, but is buggy? I can't tell due to bug in above paragraph). Actually, I'd be happiest if stories added to the backlog defaulted to unassigned.

It took me too long to figure out how to reach the focus view, since you have to hover over the # (which I didn't realize was clickable), and it is small. Feels like there should be an easier way, though I don't have a suggestion at the moment.

Focus view of a story seems less-nice than the rest of the app. Too cluttered. Oh wait, if I hide the hint, it looks much nicer. I want to be able to widen the sidebar in focus view to have the values line up with the headings, making it shorter to get rid of the scrollbar I have there at my current window height (just a _little_ bit too short).

\</comment><comment>

Above was comments while I was playing with the app, hopefully it's organized enough, because I'm too lazy to go back and review.

I think I like your approach more than Pivotal Tracker. Cleaner, and more pleasant, although you need to work _really_ hard to address each and every interface quirk (a couple of which I mentioned above), since the primary appeal of your app is that it has a clean and fluid interface.

Customizable process (without a cluttered interface to manage it!) is a win. The way it is setup should help discourage people from having too many steps in the process, as well, since then the board would become unusable.

My 2 main sticking points:

1\. Pivotal is free (again, I have no idea why. They should be taking my money right now)

2\. I am unsure about the lack of time estimation (Pivotal provides, I think, the best method I've seen of time estimates, if you're going to have them). Maybe it's better to not have? I'm not sure.

Anyway, I have a project I'm just starting, with 1 other person. Will have to see if Zen tempts me enough to pay the $9 I'd need ;)

Some closing random thoughts:

1\. Put a mini version of your logo to the left of Features (without moving Features to the right) in the nav bar, on every page except the home page. Or something along those lines. We really do look in the top-left to get back to the home page.

2\. … just the 1 thought I guess. I had another, but I lost it.

</comment><comment><USER3> Using the phrase "crush the competition" seems to go against the rest of your site - calling the product "Zen," the bonsai tree, and the logo. At the least, it's a jarring contrast that distracts me from your product.

<comment><USER4> Pretty sure the contrast is on purpose, for humorous effect. It's just not very funny.

<comment><USER5> I actually thought it was great copy. It communicates the benefits of the product, then makes it more likable and _memorable_.

I also thought it was funny.

</comment></comment></comment><comment><USER6> Some full size screenshots would be good to have on the Tour page rather than the current lengthy text descriptions. After skimming through the whole tour, I still don't have a sense of whether or not your app is better than Basecamp.

<comment><USER7> I completely agree with this, that's the first thing I thought. I immediately search for a sample site or demo account that's a lot quicker for me than reading all that text. Or if not a demo at least a concise screencast.

</comment></comment><comment><USER8> Small recommendation - add a home link at the top navigation bar when you are at sub pages. Helps people go back to the home page if necessary.

<comment><USER9> Well you can click the logo on the right to get back home. But I agree; I reflexively looked at the top left for their logo.

</comment></comment><comment><USER10> On the landing page the headers don't actually say much – the real lines are underneath, which I didn't read while skimming. Instead of:

"Enhances visibility and communication" -> "Make it easy to understand the status of your project at a glance"

"Simple and flexible" doesn't really have any meat in it. See Kawasaki's opposite rule – your competition doesn't describe their product as "Complicated and rigid."

"Easy to get started" -> "Get started in seconds"

Specific claims add a lot more punch and right now they're ousted from prominent positioning by phrases that don't say much.

<comment><USER11> _See Kawasaki's opposite rule_

Do you have a reference for this? As of this writing, the first Google hit for "Kawasaki's opposite rule" is the parent comment. :-)

<comment><USER10> Sorry, "opposite test" was the google-able phrase.

" _Apply the opposite test._ How many times have you read a product description like this? "Our software is scalable, secure, easy-to-use, and fast?" Companies use these adjectives as if no other company claims its product is scalable, secure, easy-to-use, and fast. See if your competition uses the antonyms of the adjectives that you use to describe your product. If it doesn't, your description is useless. For example, I've never seen a company say that its product was limited, full of leaks, hard-to-use, and slow."

<http://blog.guykawasaki.com/2006/01/the_art_of_bran.html>

<comment><USER11> Thanks!

</comment></comment></comment></comment><comment><USER12> Clickable link: <http://agilezen.com/>

<comment><USER9> Link that nkohari would probably rather you click:

<http://agilezen.com/?r=hn>

</comment></comment><comment><USER13> You should combine your JavaScript.

Also, the querystring timestamps break caching in some proxies. It's a bit of a pain, but it's best to integrate the timestamp into the filename.

<comment><AUTHOR> Yeah, there are definitely opportunities for performance tweaks. I left it as- is until I can integrate it into our build process.

</comment></comment><comment><USER14> The UI is really clean, and the workflow seems pretty straighforward. Great job!

The "Add Story" sidebar doesn't render properly for me when hints are enabled (FF 3.5, Windows 7). The submit button is hidden behind the hint bar -- maybe the sidebar could be shorter so it's not covered by the hint.

<comment><AUTHOR> Thanks... and yeah, several others have said that as well. The hint panel was meant to be an overlay, but it does tend to get in the way. I'll have to tweak it. :)

</comment></comment><comment><USER15> What is Kanban? Was that the original name? I ask because it's on all of your page titles.

<comment><AUTHOR> Kanban just means "visual card" or "sign", but it's a name for a technique used in lean software practices. (Specifically, the board display in Zen is called a "kanban board".) It comes from the JIT inventory system of the Toyota Production System.

More info: <http://en.wikipedia.org/wiki/Kanban> <http://en.wikipedia.org/wiki/Lean_software_development>

</comment></comment><comment><USER16> Found and reported a bug on the work tab. Also, what is the purpose of the sizing field? Can I do anything with that or is it just a generic label for my own uses?

<comment><AUTHOR> Yeah, several people have mentioned the bug. I'm working to fix it now, although I probably won't push again until after EOB today. The size field is free-form... most people use it either with "t-shirt sizing" (small, medium, large) or just put a numeric value in. Eventually it will be used in performance metrics, so you can see your cycle time for "large" stories, for example.

<comment><USER16> Awesome thanks! Also, if I mark a task as blocked and then throw it in the backlog the task is no longer red.

Am I just doing it wrong or is this a bug?

<comment><AUTHOR> That's actually as-designed. If you block a story, it means you can't move it... so if you move it, the app figures you fixed what was wrong. :)

<comment><USER16> Also, if you type in the blocked description and then click in that same description field it erases your text. :( I lost stuff. It's best for me if it just highlighted all text. I'm using Chrome.

</comment></comment></comment></comment></comment><comment><USER17> Your "Company" page sends mixed signals. On one hand, you've obviously poured your hearts and souls into this, a big plus. OTOH, a husband and wife appearing as "President & Chief Technical Officer" and "Director of Operations" just seems a little weird to me.

This page could work for a team of 4 or 5 people with impressive backgrounds and interchangable skills, but it just shows your underwear. What if something happens to him? What if something happens to her? What if something happens to "them"?

In a strange way, the Company page is a lot like a butcher shop. We all know that, on the internet, a small company can look like a big company, but we really don't want to _see_ what goes on behind the scenes.

Is there some way you can display your strengths on this page without revealing your weaknesses?

</comment><comment><USER18> I would love the ability to designate parent/child relationships between stories.

</comment><comment><USER19> how is this different from basecamp?

</comment><comment><USER12> can't get to it

</comment><comment><USER20> Where's your feature list? I want to know if there's to-do, task assignment, email notification, time tracking, and a Wiki. :)

I would cut down with the japanese/zen "motif." This isn't a Las vegas casino, it's a web app. I don't want the joy of slowly unraveling your Internet Mystery, I want an obvious and functional and minimalist (zen!) application that Gets Things Done.

I like your color scheme</comment>


India's richest man launches 4G network with unlimited free voice calls - <AUTHOR> http://mashable.com/2016/09/01/reliance-jio-launch-tariff-plans-india/#8ZXdwar54Pqf <comment><USER2> Kingsman anyone?</comment>


Why "just do it" is bullshit - <AUTHOR> http://wayoftheduck.com/why-just-do-it-is-bullshit <comment><USER2> Sorry, but this is the dumbest blog post I've read in a while. I'm not even sure why he even bothered posting this. Is it really to say "Hard work is never enough if you want to be the top person in the world at something"? Did he just recently come to the conclusion that he has been "lied" to in that hard work isn't enough some times, and that luck and natural advantage could somehow trump everything else?

 __Of course __not everyone can become an Olympic athlete just by trying. And __of course __not everyone will be the next Steve Jobs or Zuckerberg no matter how hard they try, either. That's not the point.

The point is that most people don't even bother trying, and if you try, if you even just show up on a regular basis, you can probably reach above the 50th percentile in __anything __.

I would bet that almost anyone who puts a concerted effort into any endeavor could get to the top 25th percentile in just about anything. Hard work and hustle can bridge a lot of gap that natural ability and luck may create.

But if he is somehow just now coming to some epiphany that hard work can't trump luck and/or natural advantage (either thru ability or status), then my answer is: "Welcome to the real world." You need to temper any goals you have with maturity and realism. I'm a terrible basketball player, but I'm sure if I spent 1hr/day every day playing pickup for 1 year, by the end of a year, I'll be better than at least half of the regulars. But if my expectations are that I'll be able to dunk and beat Michael Jordan, I'd be delusional.

<comment><USER3> You haven't actually criticized any particular point of this article only stated how obvious it is and how other stuff is more important. OK, it may be obvious to you but this might be quite enlightening to other people especially those who have been fed on the kind of self-help bullshit the author is debunking. A lot of people are into that, sadly, and not smart enough--or perhaps too desperate--to understand why it is bullshit. If it's so beyond you then just move on. If you want to enlighten us do it without making slurs against other people less fortunate than yourself.

<comment><USER4> I didn't see any slurs in what he wrote. Try to be more constructive.

<comment><USER5> "dumbest blog ever" would be a pretty easy point to see. Seemed constructive to me...

<comment><USER4> How is that a slug? It sounds more like an opinion after all.

</comment></comment></comment></comment></comment><comment><USER6> While his complaint about "stating the problem as the solution" resonates with me, I found this post gained a lot more meaning when I noticed who the author was: Buster Benson, founder of a number of startups with the explicit goal of helping people make beneficial changes to their own behaviour. He's not just whining "this stuff is hard, give us a break" - he's calling for more attention on _techniques for doing hard things_.

This post from the same blog is one of the most positive and insightful "my startup is shutting down" posts I've read: <http://wayoftheduck.com/a-duck- bears-no-grudges>

> _I'm not going to wait until I have a success story to start telling it._

</comment><comment><USER7> What a bunch of negative bullshit. What do you expect Michael Phelps to say? "Hey kids who look up to me, don't follow your dreams because you probably don't have the right set of genes. Just acknowledge it's difficult and move on."

People act like being "world class" is some big mystery, but not in the 21st century. Extensive research has come to the conclusion that deliberate practice, over a long period of time, with the appropriate guidance of coaches and mentors is necessary and mostly sufficient to produce expertise in a field.

No, I don't think anyone can be Michael Phelps. In fact, it is clear that physical advantages go a long way in sports and athletic events. In almost everything else though, the right approach can produce mastery. The Polgar family is a living example of that w.r.t. chess. And most people are not looking to become world champions - they simply want to be successful in their endeavors. For that to happen, you must apply the same principles. To lose weight, I agree that saying "just diet and work out" is difficult, but most effective programs are either a result of intrinsic motivation or someone implementing a gradual program where you first cut out some sugar, then all soda, then cake, then you start eating one good meal a day, and so on and so forth.

In my view, this post marginalizes human willpower, which I consider one of the strongest forces in the world. Sure you won't be Michael Phelps, but you could say "No matter how hard you try, you will never become a Redwood," and I think the result is the same. Most people don't aspire to be world champion swimmers or extremely tall trees. They want to be successful in their endeavors, and for reasonably well off people in the Western world (which I think describes a large part of this board), there really isn't anything holding you back.

Ericsson et al. published a review of this field (expertise) in The Cambridge Handbook of Expertise and Expert Performance ([http://www.amazon.com/Cambridge-Expertise-Performance- Handbo...](http://www.amazon.com/Cambridge-Expertise-Performance-Handbooks- Psychology/dp/0521600812)). It's 900 pages but if you can't make it through a serious book then you sure as hell can't succeed in anything that requires real dedication.

<comment><USER8> An emotional reaction to this kind of realism is understandable considering how much people _want_ to believe they can be be great at anything.

But the truth is that innate differences matter not just in athletics, but in any endeavor. Even the famous Polgar sisters you mention both trailed men who had later starts and less formal early training for their entire careers. UK marathoner Paula Radcliffe's career is similar in many respects.

In general, the "purer" an endeavor is the more decisive innate differences are. By this I mean that innate differences will matter more for runners than for basketball players, more for speed skaters than hockey players, more for mathematicians than for hedge fund quants, etc...

But there is a great deal of evidence that innate differences create uncrossable chasms in skills far outside of athletics.

Music: <http://news.bbc.co.uk/2/hi/health/1209186.stm>

Motor Skills: <http://news.bbc.co.uk/2/hi/health/1209186.stm>

IQ & Cortical Thickening: <http://www.nytimes.com/2006/03/30/science/30brain.html?_r=1>

Language: [http://www.sciencedaily.com/releases/2005/05/050517063228.ht...](http://www.sciencedaily.com/releases/2005/05/050517063228.htm)

Facial recognition: <http://www.wired.com/wiredscience/2010/01/face- recognition/>

None of this means that willpower doesn't matter. Of course it does. However, at least accepting the reality that we don't all have the exact same potential at every pursuit can be beneficial. For one thing, it's signal _not_ to heavily invest in a tournament-style career, such as modelling or concert violin playing, unless you have a clear aptitude. Even for more forgiving careers, where merely being competent is enough to make a good living, it's rational to choose a career that aligns with your natural talents. Why put X amount of effort to be in the 70th percentile of some field when the same amount of effort would make you 90th percentile in another comparably in- demand field? Most people are happier doing what they're good at.

<comment><USER9> I agree that world champion level aspirations are not realistic for everyone. This doesn't mean the people who do not have innate talent are leagues below world champions though. In my observations, talent causes an athlete to become proficient faster, and to end up being _very slightly_ better than untalented people who work very hard. Of course, at the level of world champions, very slightly better is the difference between first place and middle of the pack.

<comment><USER8> The problem is that in tournament-style professions, their prospects are leagues below that of the world champions.

One heart breaking example I witnessed personally was a family member. He wanted more than anything to be a classical musician. From the age of four, he was taught by the same teacher who trained a very successful NY Philharmonic pianist (opera coach). He practiced many hours a day all through his school years and earned both undergraduate and graduate degrees in clarinet performance. By any objective measure he was a very good clarinetist. But he wasn't good enough to make a real living at it. Unlike his mother, who had perfect pitch by the end of grade school, he never developed it. He saw more than one talented peer surpass him in despite his extreme work ethic. In the end, after putting over 25 years of his life and his passion into it, he finally gave up on his dream and became a programmer. Unlike his experiences in music, he very quickly rose to the top of development groups and it was he who was the one surpassing others who had been working at it longer and harder.

I often wonder what he could have done if he'd given up his initial dream after just 10 years instead of 25.

</comment></comment></comment></comment><comment><USER10> "just do it" is the _opposite_ of the "anything is possible if you put your mind to it" slogan. The "anything is possible" slogan implies that failure is always surmountable, which it obviously isn't.

"just do it" means specifically, "so what if you won't be an olympic star, won't lose 200 pounds or win a marathon, won't become a millionaire, even if your attempts fail and you totally suck at something, if you truly are interested in it and have a passion for it, don't discourage yourself, just _do it anyway_." Life is all about showing up and trying.

I played for years with a singer-songwriter who was just awful - tone deaf, fairly dorky, lame songs, guitar strings popping out, pretty bad. We were booed on stage more than once. After a couple of years I couldn't take it anymore and I quit that band. Years later I saw him play and he was totally great, had a fanbase and everything, and had done several tours in europe where he got really polished.

He kept at it for years, learned as much as he could from everyone he interacted with, and eventually learned enough to start playing first acceptably, then actually pretty well, within his niche, and today he makes his living full time as a musician. He was simply incapable of was taking to heart all the negative responses he got. They kind of just bounced off of him, and he persevered. When I saw him perform, one of his songs was called "Everything Sucks", and it was specifically about _me_ and the really negative attitude I always had when we used to play together. Fans in the audience cheered for the song and they knew the words. It was sort of a teaching moment about negativity for me.

Anyway that's what "just do it" means. It means don't let negativity get in the way of what you feel like doing.

<comment><USER9> Thanks for the unique perspective Mike :) Next time I'm in NYC I definitely need to buy you a beer.

</comment></comment><comment><USER11> Before my wife and I got married, we had a very intense year-long running argument about this exact topic. She told me I could do anything I wanted to do; I told her that was bullshit. I think this argument may have delayed our marriage significantly. :)

Since then, I've noticed that naively optimistic views are relatively common among people who accomplish interesting things. It's almost as if naive optimism is a semi-necessary precursor to remarkable achievement.

"You can do anything" is nonsense. It's a crutch. But many people use this crutch to get to really cool places, and I can't help but respect their accomplishments in the end.

<comment><USER12> I posted an article earlier this week that got no traction, but discusses exactly this.

According to the article and the paper it references, people fall predominantly into two populations which are distingquished by their beliefs vis-a-vis achievement. The first population believes, inherently and without evidence, in the supremacy of accomplishing achievements. People in second population have as their primary motive the avoidance of failure.

The paper and the article go on to detail the set of post-hoc rationalizations which support these beliefs, and how these were discovered.

Article and paper: [http://www.psychologytoday.com/blog/youre- hired/201110/how-d...](http://www.psychologytoday.com/blog/youre- hired/201110/how-do-high-achievers-really-think)

HN (non-)discussion: <http://news.ycombinator.com/item?id=4307947>

<comment><USER13> Thanks. That's much more interesting and informative than the post in question and the comments in this thread.

</comment></comment></comment><comment><USER5> Wow these responses are pretty shocking to me. To me this reads much more like the Steinbeck quote of "Socialism never took root in America because the poor see themselves not as an exploited proletariat but as temporarily embarrassed millionaires."

We end up talking about how amazing it is that these people have accomplished what they have but don't bother to consider that there are others who could not possibly have gotten that because they don't have the advantages the other person did.

I'm not super familiar with Phelp's backstory, but I assume he swam a fuckton when he was younger, his parents drove him around the country to events, etc. Many people don't have the time, money and resources to do these things. Telling a poor kid "just do what Michael Phelps did" while ignoring the vast, vast difference between their situations is completely ridiculous and kind of the way our society now works.

Not successful because you couldnt afford to go to school because you had to bring home money to help your parents pay the rent? Hearing "just work as hard as I did" from some white republican kid who got a trust fund is basically the same thing you guys are saying everyone should just overcome.

<comment><USER14> Yep. This is what I took away from it.

Let's be honest: the predominant socioeconomic class among hackers and entrepreneurs is a set who have a relatively large set of advantages, many of which are unexamined. This comment thread is a textbook reaction to an accusation that maybe, just maybe, some people have advantages which have directly or indirectly contributed to their success, perhaps as much as any other factor.

Some people call this "loser" talk, when I'd say, aggregated across not just our own extremely narrow cross-section of society, it's pretty realistic.

As he says, the corollary to "just do it" is that if you didn't succeed, it's because you weren't trying. That may not be what anyone here is suggesting (or it may!), but it's undeniable that there's an entire political party in the US which takes this as an article of faith. If you're wealthy, it's because you earned it; if it's poor, you're not working hard enough.

See also: <http://en.wikipedia.org/wiki/Fundamental_attribution_error> [http://en.wikipedia.org/wiki/Actor%E2%80%93observer_asymmetr...](http://en.wikipedia.org/wiki/Actor%E2%80%93observer_asymmetry) <http://en.wikipedia.org/wiki/Just-world_phenomenon>

I do think there is something to the idea of XX% of success is just showing up. It's just that "showing up" elides plenty of complexity and it's not often I see people acknowledge that.

</comment></comment><comment><USER8> If you or I had started swimming at age 4 and had top coaching, There would be little hope against a genetic freak like Phelps. Also, the existence of him and many other slightly less extreme genetic freaks means that it would be a very, very poor idea to invest time in trying to become a great swimmer. Unlike them, we'd have no career prospects.

The author was right. It's much better to invest time and effort into a pursuit where you have an advantage. And it follows logically that if you don't have any natural advantages, then you should stay the heck away from winner-take-all professions.

</comment><comment><USER15> More inane babbling by svbtle bloggers. How is this hacker news worthy?

<comment><USER16> First time I've seen a front page article blasted by 100% of the comments. Finally, complete agreement in the comment section! I'm wondering how it got to the front page too.

</comment></comment><comment><USER17> This article seems to be all about the definition of "everything" in "everything is possible if you put your mind to it". For the author "everything" includes swimming faster than Michael Phelps even if you didn't start swimming at an age of 7. That's a tough one.

The saying is much more useful if you consider only the things that are possible given the current circumstances. I may not become as fast as Michael Phelps, but I can definitely become as fast as I can possibly be given my current situation. If you look at it that way, "Just do it" applies and it's a good motto to live by.

<comment><USER18> Well put, the article takes 'everything' a bit literally. Why strive to swim better than Michael Phelps? Just swim to swim and get better (forget trying to be the best in the world and just simply do it).

</comment></comment><comment><USER19> Was this written by a high schooler? I mean, if some freshman said this, most of us would just chock this up to being a smart aleck, sheltered kid with too much time on their hands and thus points the most banal things "You can't swim 100m butterfly in 1ns." Is that supposed to be edifying?

Obviously, when people say "anything is possible you just have to work at it" or things like that, they assume the audience is reasonable. They aren't saying a 100 year old in a nursing home is going to be able to play in the NHL competitively by just working hard. What kind of gibberish is this?

</comment><comment><USER20> Loser's attitude. Yes, it might be impossible to be the best just by putting in hard work. But hard work and belief that you can accomplish is prerequisite to ever finding out if you can be the best.

</comment><comment><USER21> The point here is that natural advantages make you more capable for some things than others. You can't be blamed for not being able to achieve something that you shouldn't have realistically expected to achieve.

That said, some things are your fault. I still bite my nails at 19. Forcing myself to quit is possible, and I have only myself to blame if I don't. It's the same for weight-loss, so that's a horrible example.

</comment><comment><USER22> I don't find the world's best athletes inspiring, precisely because they often benefit from quirks of their physiology that I don't share or training that dates back to their single-digit years, or both.

I do find athletes in technical sports like sailing, rock climbing, extreme- depth diving inspiring because those sports require a combination of physical ability and problem solving. Sailing is particularly inspiring because even the least able sailor is able to leverage some of the most powerful forces on earth to their advantage. But even Dennis Conner can't sail directly into the wind.

Getting back to the original post, I do find it useful as an engineer to attempt impossible things from time to time. Often the impossible is just inside our heads. Sometimes our expectations for our self are too low. But sometimes our egos are too big and we benefit from failing at something impossible too.

There's some truth to Phelps' statement. But if you find yourself on an alien planet, don't take off your space suit and start petting the weird snake- creatures.

<comment><USER23> >because those sports require a combination of physical ability and problem solving

I don't understand. Are you saying popular sports like soccer don't require problem solving?

<comment><USER22> I can see how team sports are interesting, I'm just not that into them. They definitely require problem solving.

</comment></comment></comment><comment><USER24> I've always thought that at a local level, you can become the best with enough hard work. Want to be the fastest runner, swimmer, or the student with the highest grades at your high school? Just work harder.

It gets more difficult when you reach world-class. That's where genetics come into play, because at that point it's hard to argue that anyone is really outworking anyone else.

</comment><comment><USER25> IMHO, this blog post only sees a narrow part of the picture, and gets it wrong.

To get anything done, we need to (1) have the desire, (2) turn this desire into action, and (3) continue the action and fight through barriers until we achieve what we want. "Just do it" works well as a mantra to turn the desire into action.

However, after this step, there is a whole lot more. How much natural ability do you have? How hard are you working? How much competition is there in the area? Are there political, legal, or other barriers in the way? There are many factors determining how far you will go. But, getting started is better than not getting started at all. This is an important step that is often not taken.

A more accurate way to put is is that "just do it" is necessary, but not sufficient.

I should say that I just wrote a blog post in the "just do it" camp so it may skew my views:

[http://alexshye.wordpress.com/2012/07/10/the-most- important-...](http://alexshye.wordpress.com/2012/07/10/the-most-important- lesson-i-ever-learned/)

</comment><comment><USER9> Natural advantages are typically a fairly small boost. In most cases it is possible to modify the way you do things to take advantage of your anatomy and physiology. File this one under "know thyself".

Also, don't forget that there are enough people out there that someone with all the natural advantages is going to be working insanely hard. This is why having olympic aspirations is unrealistic; in a realm where a few tenths of a second is the difference between gold and going home empty handed, natural advantages matter.

Don't just work hard, think hard, explore all your options, understand what you are trying to do on a deeper level, then attack it as if your life or death depended on the outcome. Failure cannot be an option.

</comment><comment><USER26> The argument that Phelps's success is paritularly reliant on his genetic build is slightly begging the question. His physical features are considered to be ideal for a top swimmer because, well, a top swimmer happens to have them.

This does not automatically rule out the possibility that a swimmer with a shorter wingspan could break Phelps' record...because that person may have adapted to that deficiency by improving on a quality that was less important to someone of Phelps' wingspan...in the way that people with a missing limb or sense become stronger in the other ones.

This is all just to say that not-trying can't be predicated on "well, I don't share the same qualities as the current record holder"

</comment><comment><USER27> I think the points here are -

1\. Phelps is at the top based on the system of measurement we've agreed upon. No need to worship him. 2\. Use him to inspire yoursleves in the endeavours YOU want to undertake, and NOT to become Phelps. 3\. Stop feeling bad about yourselves for not being Phelps. 4\. Use happiness as your yardstick and not what others think about you. 5\. Don't force yourself to immitate others, instead spend time on discovering what you love and allow/push yourself to excel in it. 6\. If you do, you'll enjoy watching Phelps and move on with your life. 7\. Replace Phelps above with Jobs/Jordan/James Bond...

Peace.

K

</comment><comment><USER28> Not to commercialize the conversation, but this Nike ad (pretty creative IMO) speaks well to this issue: <http://www.youtube.com/watch?v=LsXRj89cWa0>.

The problem with this post is it says nothing about what the alternative is. I guess it's implicit: give up. I'd rather believe I can do it, work like hell and then see where I come up short. But if others would rather sit on the couch explaining why they didn't try, that's cool too.

</comment><comment><USER29> Wanking article.

I've known several (relatively) late-blooming competitive swimmers who didn't begin training until their teenage years, and a few other athletes who began later than that (20s, 30s, and beyond), reaching national or international class.

Gail Roper comes to mind. She was largely passed over for swimming in high school, but came to be one of the most dominant masters and open-water swimmers of all time. A few decades back I had the distinct pleasure of being beat by over 4 minutes by her, which I figured was fine given that she had a 40 year head start. [http://www.girlscantwhat.com/meet-gail-roper-the-most- domina...](http://www.girlscantwhat.com/meet-gail-roper-the-most-dominant- swimmer-ever/)

The "you can do anything" mentality is, of course, false on its face. Athletes, entrepreneurs, and artists, when confronted with a microphone shoved into their face, will say whatever damned fool thing pops into their head, sometimes honestly, often not. If you want to know the real secrets to their success, look at what they do, not what they say.

And yes, Phelps is a genetic freak pretty much uniquely suited to swimming.

He's also just another human being. And at the end of a race, his muscles and lungs are burning just like anyone else's would be.

That said, the accomplishment domain most of us are competing in is "doing stuff", surrounded by others trying to do the same thing. _If you want to become accomplished at something_ , then a mix of innate ability, talent, and hard work will push you somewhere toward the envelope. Perhaps well inside, perhaps outside.

A huge part of success, beyond what you _can't_ control (your genes, circumstances, starting at age 7) is to practice efficiency in how you go about reaching your goal. As many hours as a person puts into pursuing a given goal, there are far more hours spent _not_ pursing it. In the tech world, most of us come to realize that beyond a few hours a day, if we're lucky, we're not terribly productive.

Athletes may spend a few hours a day engaged in training, but the real pay-off moments may be a few minutes of Tabata intervals, or a set or two of max- effort lifts. Everything else is preparation, support, preventive measures, recovery, or just plain goofing around. What's impressive is how _little_ of the _right_ effort is required to _improve_ your ability. Perhaps not win you a gold medal, but at least to nudge you in that direction.

In another context I saw yet another question of the form "how much can I expect to progress if I do X?", and saw the usual responses, some backed with links to substantial research, of what typical and outstanding progress might be. One response came close to what I realized was the right answer: "and if you don't hit some goal rate of progress, are you going to quit?".

The answer is: you'll make more progress than if you don't do X.

So: pick a reasonable goal, within the realms of physics and biological attainability. Find out if it really suits you (are you doing this for you, for for someone else). Find effective means of attaining your goal. Apply those methods. Monitor your progress. You may find you are able to go further. You may find the goal is out of reach. You may find the goal doesn't interest you.

But you tried, and you learned something.

<comment><USER30> To be honest, people wouldn't pursue or even try swimming if they weren't predisposed to. You implicitly know if you can progress to a certain level when you start.

YES some people have the capability and DO NOT try. Maybe the message works for them. But for the VAST majority that's not the case.

Following that logic we'd (almost) all be champions by now.

But then you go with "you may find the goal is out of reach". That's the freaking point of the article. Can't have it both ways.

<comment><USER29> I I also know a lot of pretty slow swimmers who nonetheless manage to do some pretty impressive feats.

With training, there's a response. You'll get faster, improve your endurance, power, strength, skill, whatever. This applies to programming, project management, swimming, gymnastics, painting, or chess.

Some people have the innate ability to go further. Some don't. _All_ human ability falls along a spectrum, and most of us for any given activity are somewhere in the middle. Depending on the activity, the curve may be longer or shorter (you'll reach your ability after more or less training). Early adaptation is frequently fast, progress tapers off with time.

As I said above: with appropriate training, you'll be better than if you hadn't trained. How much better really depends. In most cases, though, you'll learn fairly quickly -- perhaps a few days, perhaps a few years -- how much talent you have. Developing that talent is then a matter of developing the skill. In some cases, skill/ability development can occur over many years, even decades. Pablo Morales and Dara Torres have shown that Olympic class swimmers can compete in their 30s and 40s, strength athletes may have similar careers. Some skill activities (conjuring, dance) even longer. Other skills peak early (few gymnasts compete past their teen years).

My point about the article was that there was a hell of a lot of defeatism and lack of rigor to arguments provided, on a topic that's blatantly obvious to start with.

I'll still bet most people could, if they tried, pursue a given goal further than a casual assessment would suggest.

So: no, "anything is possible" doesn't apply, but "some things are possible" does, and

</comment></comment></comment><comment><USER31> Dude it's just a pep talk we tell each other to focus us on executing over psyching ourselves out with over thinking, over strategizing, and noise of others telling us its stupid. Kinda like you're doing now. Apparently you'll need a new customized phrase to help you focus so here it is: Shut up and just do it.

</comment><comment><USER32> Counter point from the VC Mark Suster, from 2009[1]:

 _What Makes an Entrepreneur? Four Letters: JFDI_

[1] [http://www.bothsidesofthetable.com/2009/11/19/what-makes- an-...](http://www.bothsidesofthetable.com/2009/11/19/what-makes-an- entrepreneur-four-lettersjfdi/)

</comment><comment><USER33> Olympians are the best in the world by definition. Anymore, it takes a combination of talent, hard work, and opportunity to compete at that level. However, almost anyone who really tries can get fit. That takes perseverence, and it is possible.

</comment><comment><USER34> I don't have a prob with the post, but as someone trying to "just do it," this quote helps me: "The greater danger for most of us lies not in setting our aim too high and falling short; but in setting our aim too low, and achieving our mark."

</comment><comment><USER35> I think there is a problem with the algorithm that is used for pages getting to the front page, to be honest. Pretty much every comment on here is about how vapid this post is, but how did it get to the front page???

</comment><comment><USER36> I'm a fan of the Dan Plan. Pretty cool idea. You should check it out: <http://thedanplan.com/>

</comment><comment><USER37> It's not really true, but I've always thought of it as a slogan to dispel irrational fear around trying something new. In that it has it's use.

</comment><comment><USER38> Add to that the fact that disadvantages are just as real as the advantages and it's pretty much spot on.

</comment><comment><USER39> Well that blog post was a self-wallowing waste of time.

</comment><comment><USER30> Bullshit is beautiful. I like that :)

</comment><comment><USER40> Jeremy Lin... need I say more

</comment><comment><USER41> dumbest blog post I read in a while. sorry that you had a shitty day dude...but don't worry, there is better ones coming up :)</comment>


Windows 10: HOSTS file blocking telemetry is now flagged as a risk - <AUTHOR> https://www.bleepingcomputer.com/news/microsoft/windows-10-hosts-file-blocking-telemetry-is-now-flagged-as-a-risk/ <comment><AUTHOR> > In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS > file include the following:

        www.microsoft.com
        microsoft.com
        telemetry.microsoft.com
        wns.notify.windows.com.akadns.net
        v10-win.vortex.data.microsoft.com.akadns.net
        us.vortex-win.data.microsoft.com
        us-v10.events.data.microsoft.com
        urs.microsoft.com.nsatc.net
        watson.telemetry.microsoft.com
        watson.ppe.telemetry.microsoft.com
        vsgallery.com
        watson.live.com
        watson.microsoft.com
        telemetry.remoteapp.windowsazure.com
        telemetry.urs.microsoft.com

I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed.

Oh well, there's always pihole.

Edit: On second thought, how long before they just start hard coding IP addresses?

[0]: [https://blog.malwarebytes.com/cybercrime/2016/09/hosts- file-...](https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file- hijacks/)

<comment><USER2> > Edit: On second thought, how long before they just start hard coding IP > addresses?

What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.

<comment><USER3> > IP addresses are as easy to block as domain names, but the number of IP > adresses available to them is much smaller than the number of possible > domain names.

Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.

</comment></comment></comment><comment><USER4> Telemetry isn't even the nasty one. Look for "activity" in your DNS logs. Just try to block that... All the Windows 10 machines (home and pro) on your network will freeze up and hang for extended periods of time. Microsoft wants to know every time you spawn an application, what it was, who launched it. It doesn't matter how you block it, NXDOMAIN, REFUSE, fake IP, null route, all of those will cause machines to hang. A tcp-reset will reduce the impact a little.

[Edit] MS may have wised up and consolidated the activity endpoints / vips into another endpoint. You may have to clear cache on the PC and your router, reboot and watch DNS requests as you launch applications to see where they moved.

To stop this behavior requires registry changes unless you are on Enterprise or LTSC in which case you can use GPO. There are some free programs that will do the registry tweaks for you.

Here is a video talking about manually changing some things [1] and they link to free tools that can do the changes as well [2].

[1] - [https://www.youtube.com/watch?v=tgW7iXejfqQ](https://www.youtube.com/watch?v=tgW7iXejfqQ)

[2] - [https://www.oo-software.com/en/shutup10](https://www.oo- software.com/en/shutup10)

<comment><USER5> Ah, LTSC ... never has one of my hunch-based technical decisions kept paying off again and again. if only I knew the right people instead of having to get licenses in very sketchy ways.

<comment><USER6> Just get yourself a volume license and talk to a distributor.

You do not need any crazy volume. I was able to get it in place, legitimately, for a metal fabricator that has maybe 20 computers total not including their operational technology (CNC devices) that they wanted LTSC for.

[https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1](https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1)

<comment><USER5> As just a guy? Not so easy. I'm not a company, I'm just a person.

<comment><USER7> It looks like CDW, at least, sells by the individual license, to judge from the search results at that link. Top one is "Windows 10 Enterprise LTSC 2019 - upgrade license - 1 license".

<comment><USER8> That link is for an Open License. The MS Open License program allows you to purchase volume licenses individually, but the initial MS Open License order must be for at least 5 licenses (of something).

<comment><USER9> CDW will happily sell you once license of LTSC and 4 of the cheapest SKU in the catalog (I don't know what that is, currently-- in the past it has been stuff like $5 DVD playback licenses) to get you over the minimum purchase qty.

<comment><USER10> I did exactly this with PC Connection and got into the Open license program. What's great is that you get 50 activations out of the box, so while it's a bit of money up front, it effectively allows you to use a bunch of systems and VMs internally without worry. No one is going to say anything about this especially if it's for personal use.

If you were supporting multiple users in a small business environment definitely make sure you buy as many Windows SKUs as you have end users to be compliant, however.

All of this becomes moot once you have >25 clients; then you can transition to using volume licensing and it's essentially unlimited. It still tracks it though and Microsoft can ask to look at it, especially if you change from Open to Select or some other volume pricing agreement, so keep that in mind.

<comment><USER9> I've had a sharp increase in the number of license compliance audits coming from Microsoft in the last couple years. A couple of my Customers have been targeted annually 3 years in a row. The most recent round of audits included probing questions that were clearly looking for SaaS sales opportunities.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> That's not all. Starting in Windows 8, Windows silently ignores entries in the hosts file for popular domains (ex: facebook.com). The only way to stop this is to add a file exception for C:\Windows\system32\drivers\etc\hosts in Windows Defender. As far as I know, there was no documentation explaining this.

Also, I don't know what threat model they're using to make these decisions. If you can edit the hosts file with administrative privileges, you can also add registry entry that adds a file exception in Windows Defender with the same permissions...

<comment><USER12> It was working for me last year, and I literally just tried it with "127.0.0.1 facebook.com" \+ "127.0.0.1 www.facebook.com" and it still works.

</comment></comment><comment><USER13> The article's title is misleading and clickbait. Windows is not flagging telemetry. It's flagging remapping of Microsoft domains, which is a very big no-no for every vendor.

<comment><USER14> > The article's title is misleading and clickbait. Windows is not flagging > telemetry. It's flagging remapping of Microsoft domains, which is a very big > no-no for every vendor.

The title is:

> Windows 10: HOSTS file blocking telemetry is now flagged as a risk

That seems clear to me about what is being flagged. I don't see any implication that telemetry is being flagged, and I'm not quite sure why anyone would think it would be—although I'd love it if Windows were to start reporting that its own telemetry was a risk, I don't see that in the cards.

</comment></comment><comment><USER15> Want to Jailbreak your iPhone with unc0ver? You're probably going to go to unc0ver.dev and download unc0ver.ipa for sideloading. However, if you're on Windows 10, you may find that the the ipa file suddenly disappears from your PC as soon as it has finished downloading.

Surprise! Windows Defender detected the Jailbreak and helpfully removed the file to keep you safe! This is _not_ a false positive, Windows Defender literally lists "Jailbreak" as the reason the file is dangerous. Never mind that it's a user-initiated jailbreak for an entirely different, non-Microsoft Operating System!

Repeat the same process on macOS—y'know, the OS from a company that actually has an interest in stopping this stuff. Does unc0ver.ipa get deleted by XProtect? Nope! Apple understands that these systems should only ever be used for actual viruses. To do anything else is a severe betrayal of user trust.

IMO, Windows Defender has jumped the shark, and sadly, I've now resorted to disabling it on all personal Windows machines.

<comment><USER16> I downloaded the unc0ver IPA just now. Still there. Ran a scan on my downloads folder to see if it gets picked up. Still there. Don't know what the heck is going on with your system _shrug_

<comment><USER15> Huh, well I last did this around a year ago, so it may be that an update to either Windows Defender or unc0ver fixed/avoided the problem.

The fact that it happened at all, however, seriously doesn't sit right with me.

<comment><USER17> > The fact that it happened at all, however, seriously doesn't sit right with > me.

It probably detected some of the techniques they used in the file as things used in exploits (since there's little difference in a jailbreak/security exploit from a technical perspective). The fact that it catches is in that case a good thing. That it doesn't catch it anymore might point towards them getting a report that it's a false positive of their automated binary matching, and making an exception to allow it. Apple not catching it could then indicate that either Apple already allowed it, or Apple's exploit detection is less sophisticated and wasn't able to see the problem.

I don't know if that situation is correct, but it seems just as plausible to me, and in that case, Defender is doing exactly what I would want, responded to a report exactly as I would want and expect, and has multiple mechanisms to bypass the initial problem (add folder that's not scanned, disable entirely, etc), and your experience with Apple points towards them either being a little quicker with the exception or just worse at doing what I would want.

<comment><USER15> If it was a mistake due to overall techniques, why did Windows Defender mark it as a "Jailbreak" as opposed to a trojan or some such? That was the thing that made me really upset, once I saw it.

<comment><USER17> Possibly because windows offers sandbox capabilities as well, and breaking out of that would be classified as a jailbreak.

Even if someone at Microsoft got overzealous (or a third party reported it), the software is literally designed to find and quarantine exploits (which a jailbreak is), and there are ways to bypass it even if it wasn't apparently reversed later. The item detected _is_ an exploit, just for a different system. It's exactly the sort of false positive I would expect, and the fact that you can work around it without major issues (whether through a special download folder you create and mark as not scanned immediately or temporarily disabling it) is exactly what I would expect.

It's sort of like if you owned a furniture store, and have a security guard to watch it. One night after hours, some guys in street clothes show up in a truck and loiter for a bit before going in the back and starting to take some furniture to the truck. Sure, these guys are your cousins, and are doing stuff on your behalf, but does the guard know that? Did you tell the guard? Would you rather the security guard go stop everything immediately and call you to confirm what's going on, or just shrug and say "eh, it's probably fine"? You're paying them to stop bad stuff, you should expect them to stop bad stuff, and when they find false positives that look like the real thing, that should be reassuring that they're doing their job, not grounds for dismissal.

</comment></comment></comment></comment></comment></comment><comment><USER18> Skip the Windows HOSTS file and use something like Acrylic DNS[0], works great for me and supports wildcards.

I even use it together with the router to have my phone use the DNS and you can see which hosts get connected and so on as you use the phone. It ain't pretty.

[0]: [https://mayakron.altervista.org/support/acrylic/Home.htm](https://mayakron.altervista.org/support/acrylic/Home.htm)

<comment><USER19> any curated block lists you recommend for the lazy?

<comment><USER20> I have an extremely basic one on my Windows machine - [https://pastebin.com/ZfUv6E2c](https://pastebin.com/ZfUv6E2c)

Bing, Facebook, Windows Web Search and some other sites don't work (unless you use DNS over https in Firefox, which ignores the host files.)

Go through r/pihole for the recommended ones.

</comment></comment></comment><comment><USER21> For DNS blocking, I've switched my home devices to NextDNS and it works great. It has DoH/DoT, bundles a lot of blocking lists and has no logs option which are all I need. And I can manually add these domain names to blocklist if they're not added in any one yet.

</comment><comment><USER22> www.microsoft.com is also used for updates. By doing this block a lot of viruses prevent defender and windows from patching.

</comment><comment><USER23> I have Win10 Enterprise from a corporate MSDN license. So, I just used gpedit to disable telemetry. What else should I be doing to my install to get rid of all the "leakiness"?

<comment><USER23> Actually I found this, which seems to be comprehensive (though a bit out of date)

[https://proprivacy.com/privacy-service/guides/how-to- disable...](https://proprivacy.com/privacy-service/guides/how-to-disable- windows-10-data-collection)

<comment><USER24> Doesn't seem very comprehensive if you are using an enterprise of LTSC build, no mention of gpedit.

</comment></comment></comment><comment><USER25> These blocks may also prevent Microsoft from getting updates, including new virus scanning profiles. I'd say that blocking access to them could be a risk.

<comment><USER26> "Accept our tracking your every move or you don't get virus updates" sounds like "Give me your wallet and I won't shoot you".

</comment></comment><comment><USER27> If I lost trust in an OS, I would stop running it. Trying to fight an OS as a mere client of the OS is asymmetric warfare

<comment><USER28> And use what instead? I generally use linux on my desktop but have to reboot fairly often to do something windows-related. Libreoffice botches document formatting every time I use it on something above "hello, world." Lots of stuff still only works on windows, though wine compatibility is getting better.

<comment><USER29> I use Windows inside Linux KVM virtual machine mostly for gaming. One of my GPUs passed through into VM with PCI passthrough.

<comment><USER30> Same setup here. Best of both worlds IMO. Only drawback is to use the GPU on the linux host for e.g. Blender, I need to reboot (GPU can't rebind to PCIe root otherwise or something... thanks Nvidia)

<comment> em-bee to you and parent, what's your experience running games in a VM? i prefer to run linux, but there are a few games that are windows only that i'd like to play.

which VM software are you using? can you recommend any resources?

<comment><USER29> It's very close to native performance. Only major issue I had is crackling sound, but it's resolvable. In my setup I have second set of controls (keyboard + mouse) to be forwarded to guest and HDMI output of guest GPU is connected to HDMI switch. Once everything set up, it looks and feels like you have second PC under your desk.

I use conventional Linux KVM virtualization ("libvirtd" \+ "virt-manager" GUI) on Fedora 32 (previously used Debian).

Most valuable resource is Arch Wiki: [https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVM...](https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVMF)

I've never used Arch Linux, however I always refer to Arch Wiki - it's extremely useful even for other distros.

<comment> em-bee nice, a second desktop would mean that two people can use the machine at the same time. i like that.

i was mostly worried about demanding games needing graphics features that would not work in a VM. (and usb support for the bank dongle)

i am also

<comment> em-bee aparently incapable of properly proofreading my messages

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> Users blocking telemetry using .../etc/hosts are presumably power users, and, as such, are informed about this new twist - and this twist may even inform them that Microsoft uses IPs as a fallback in case DNS resolution fails. The outcome of this stunt may thus be worse than before it.

So what is to be gained from this?

</comment><comment><USER32> This should somehow be defined as ilegal.

I, as user, should have the power, to definitely, unquestionably block MS to track my computer.

<comment> yjftsjthsd-h I'm actually curious if this happens in the EU, and if so how it doesn't violate GDPR.

<comment><USER33> I'm not a lawyer, but I think might depend on what data is being collected here. I believe they'd be fine if it doesn't fall under the "personal data" category.

You might actually be accepting some GDPR processing agreement when setting up Windows nowadays.

And there's a whole thing in GDPR about grandfathering consent. Which they might fall back on.

But like I said, I'm not a lawyer. I'm not qualified enough to know for sure.

<comment><USER14> > And there's a whole thing in GDPR about grandfathering consent. Which they > might fall back on.

Wouldn't that apply, if at all, only to users who started before GDPR?

<comment><USER33> Yes, that's specifically for users before GDPR.

But GDPR can be a bit vague, both in definition and enforcement.

I'm not sure how Microsoft implements GDPR agreements. But I'm not sure if you'd have to agree to their policies on a Microsoft account level, or if it's per installation of Windows.

</comment></comment></comment></comment></comment><comment><USER34> The Pro and higher versions allow you to just disable Defender via GPO. That's what I always do anyway.

</comment><comment><USER35> Block these domains with dnscrypt-proxy instead.

</comment><comment><USER36> It must be hard making decisions at that level.

</comment><comment><USER37> Use Linux

</comment><comment><USER38> Do pi-hole you fools</comment>


Ask HN: Is this a XSS? What else can I do? - <AUTHOR>

Hi,
About 3 weeks ago I was posting something to posterous and noticed that there was something weird at the top of the page.
Inspecting, playing around and such I figured out and inserted JS into the post, doing an alert() when the page loaded. http://i.imgur.com/pL8W2.png
From what I know, and what I have read this is an XSS, Im not completely sure of which length of script could I execute but I think it could be enough to load a script from another page, and then do the malicious stuff.
I contacted Posterous through their Feedback form about 3 or 4 weeks ago, and I havent received an answer. Since the post still shows the alert and its not fixed they may have not read the mail or discarded it...
Can anybody confirm that this is dangerous? <comment><USER2> I just took a look and there appear to be some risks associated with this vulnerability.

If you log in to Posterous and check the "Remember me" box, it sets a cookie scoped to .posterous.com (which means it's within the scope of this XSS). That cookie does not have the HttpOnly flag set, which means it can be accessed via Javascript. I'm not sure whether the auth_token cookie has any protections against session hijacking (ie: if it's restricted to the IP that was used to log in). If it doesn't, you can steal the cookie and log in as a user.

Outside of that, the site appears to use a cookie called _sharebymail_session_id, which is scoped the same as auth_token but which is marked HttpOnly, which means it can't be accessed directly via Javascript.

In order to really exploit this vulnerability, you would need to find a way to send requests to and read responses from posterous.com, the root domain, since that's where all the functionality is defined.

</comment><comment><USER3> It can be dangerous yes, somebody could exploit this. Not sure who you should contact at Posterous tho ...

</comment><comment><USER4> Contact email@example.com</comment>


A Tech Boom in Pittsburg Bring Hope and Angst - <AUTHOR> https://www.reuters.com/article/us-pittsburgh-tech/a-tech-boom-in-pittsburgh-brings-hope-and-angst-idUSKCN1MM13Y <comment><USER2> Pittsburg _h_. PA, not CA.</comment>


Singapore's fake news law should be a warning to American lawmakers - <AUTHOR> https://www.theverge.com/interface/2019/12/3/20991422/singapore-fake-news-law-censorship-politics-usa <comment><USER2> Context matters, though. A law may have a beneficial effect in a democratic country with a strong culture of distributed oversight, but the _exact same law_ may have an adverse effect in an authoritarian country.

</comment><comment><USER3> Thankfully 1A shields us from speech restricting laws.</comment>


Rails - Security Problem with authenticate_with_http_digest - <AUTHOR> http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest

<comment><USER2> I agree that it is sad how the Rails "team" handled this.

I have always felt that security issues should be treated like any other defect. It makes me sad that the Rails community tries to obscure its security problems and "shoot the messenger". The guy that reported the bug is _trying to help you_ and _trying to help the community_. Getting mad at him isn't going to make the bug go away, it's just going to make you look like a childish moron. (Everyone writes buggy code; get over it.)

(The "we don't want hackers to know" argument is often repeated, but completely meaningless. If the security hole is worth exploiting, the black- hats found it a long time ago. Pretending that this one bug is somehow different so it should be treated specially is delusional. Deluding yourself can feel good, but it doesn't yield good software.)

Anyway, the advantage of full disclosure is that users can take mitigating actions before there is an official response. Sometimes taking your app down is better than waiting for some "core team" to make an "official fix". Letting the users know also lets one of the users contribute a fix -- which is the whole point of free software. "Many eyes" and all that.

Finally, if you are using un-audited code for important parts of your infrastructure, you get what you deserve. The Rails team is not to blame; you are.

</comment><comment><USER3> So much nerd rage and finger pointing in the comments there... really makes me dislike being a rails developer. I love RoR, but sometimes I really feel like the 'community' is just awful...</comment>


U.S. Attorney Moves to Dismiss Murder-For-Hire Charges Against Ross Ulbricht - <AUTHOR> https://www.ccn.com/u-s-attorney-moves-to-dismiss-murder-for-hire-charges-against-ross-ulbricht/amp/ <comment><USER2> Ross Ulbricht is not done with the courts because, contrary to popular belief and media reporting, the Supreme Court is not the last stop on the appeals process line.

Next on tap for Mr. Ulbricht is the time-honored 2255 motion. Mr. Ulbricht now has until next June to file a civil lawsuit against the US government accusing it of violating his civil rights and seeking the verdict to be set aside or his sentence to be redetermined.

Why bring it up? 2255's are far more likely to succeed than a Supreme Court petition (the high court gets more petitions every year and yet considers fewer of them every year). Why now? The law says you can't bring up a 2255 until your last conventional appeal is exhausted.

Further, the 2255 gets to be considered by the very same trial judge who convicted and sentenced him. While that's a foregone conclusion, the second circuit will no doubt thereafter be asked to consider that petition, and might decide to either set Ulbricht free or reduce his time to maybe 10 years or time served, given how ridiculously beyond the pale the original sentence was.

I wouldn't be at all surprised if Ross considered the Supreme Court taking his case as being a snowball's chance in hell for the year-plus they've been sitting on the case, and has just been looking forward to finally filing his 2255.

Keep watching. It might be about to get good.

<comment><AUTHOR> Wouldn't the Second Circuit have already found a way, a procedural technicality or whatever, if they felt the sentence was "beyond the pale"?

They did confirm the judgement, right?

<comment><USER2> You probably mean "affirm", which is lawyerese for confirm.

No, circuit courts limit themselves to what your appellate counsel brings, and strictly limits what you can bring up by limiting the amount of time at argument to 30 minutes or less. That translates to, at most, 2 issues, and I'm sure Mr. Ulbricht can point to over 200 at this point (2255's have a page limit, and you can move for extra pages, but you are pretty much stuck filing a 2255 only once).

Further, the original appellate process only considers matters of law (was XYZ a crime) and not matters of fact (witness alleging XYZ was also convicted for stealing Ross' bitcoins), so the juiciest stuff was barred until now.

Further, the panel of circuit judges that originally affirmed things can differ markedly with the judges who'll grant the certificate of appealability and/or consider the 2255 petition.

<comment><USER3> What two issues (of the 200 you mentioned) do you expect his council to argue? Why do you anticipate he will win?

<comment><USER2> Let me clear up the confusion. The original appeal is highly limited to at most two issues, and strictly matters of law.

The 2255 is wide open. You're limited by the number of pages (and the realization that if the first, say, 10 claims you bring up fail, maybe it wasn't likely to make a difference if you file any more).

Mention of counsel is funny, because 2/3 of 2255 issues tend to revolve around "ineffective assistance of counsel" (IAC). As such, you generally have to get a different lawyer or do it yourself, since no lawyer will accuse himself of doing a bad job with a straight face.

IAC may include anything from the attorney forgetting to bring up something important, to declaring the defendant guilty in open court, to falling asleep at trial. It generally has to be something really really unprofessional, and the defendant had to have suffered "prejudice". In other words, if you were, based on the mountain of evidence, going to be found guilty, whether or not (for example) your attorney slept with your wife, you suffered no prejudice and the verdict and sentence stand.

I'm sure in that pile of 2255 complaints will be the matter that the investigating officers and leading state witnesses (Carl Mark Force IV, FBI, and Shaun Bridges, Secret Service) committed perjury and theft and this prejudiced Ulbricht's right to a fair trial.

There will probably also be matter about unlawful search and seizure by the feds using hacking tools, etc.

I have a feeling the most fascinating stuff will be unknown to the public thus far.

</comment></comment></comment></comment></comment><comment><USER4> As always, worth remembering that the "murder for hire" scheme was a predicate in the conspiracy charge Ulbricht faced†; it was introduced at trial, Ulbricht was formally accused of it, and his defense had an obligation to refute it. People on message boards tend to believe that Ulbricht was never confronted with an actual charge that he tried to have someone killed, but was merely smeared with it during sentence. That is not the case.

The fact that Ulbricht has a locked-in life sentence on a charge that involved the murder-for-hire scheme makes a separate murder prosecution pointless. Had he actually succeeded in his plan to have someone killed, the trial would serve a purpose (for the family of the victim, at least). But he didn't.

 _Source: you can just read the indictment for the case he lost, which discusses the murder-for-hire scheme directly._

<comment><USER5> In the US court system, a defendant is not required to refute a charge--it is the obligation of the prosecution to prove all of the elements of a given charge.

However, because conspiracy is a separate crime, it can in some cases survive the voiding of the underlying crime, i.e., in this case the purported attempted murder.

<comment><USER4> Evidence for the charge was presented in the indictment and, I believe, at trial. The defense failed to address it. Obviously, the defense can do so because they think the evidence is _prima facie_ unconvincing; the defense isn't obligated to overtly speak directly to it (see today's Manafort trial, in which the defense just rested without bringing a case, and the Popehat thread about why that's common in criminal cases). But we see how that worked out for Ulbricht: he was convicted and got a life sentence.

<comment><USER5> We're talking about 2 different things.

The Defendant is never required to disprove a criminal charge, or any factor of a criminal charge, which is what I'm saying.

However, once the prosecution has provided prima facie evidence of each factor of a criminal charge, it is generally advisable to attack the credibility/reliability of the evidence supporting that factor. Which is what you're saying. It isn't necessary for a defendant to present a defense, and in many cases defendants don't bother, since they never actually had a defense. They were simply hoping the prosecution would fail to prove its case to the jury.

<comment><USER4> I agree that we are talking about two different things.

</comment></comment></comment></comment></comment><comment><USER6> After reading American Kingpin I get that Ulbricht did a lot of bad things, broke many laws, and should be punished. Yet at the same time the length of his sentence feels more like government retribution than punishment. The government piled on and I feel there's a strange parallel to be drawn between Mr. Ulbricht and Kevin Mitnick's abuse by the government. I hope his sentence is severely reduced and he gets a chance at rehabilitation and redemption.

</comment><comment><USER7> ...because his appeal to the Supreme Court was denied, and he'll be unable to avoid serving the rest of his life in prison, so a conviction would serve no purpose.

<comment><USER8> It probably also has a lot to do with the corruption scandal with Bridges, Force, and possibly even more dirty cops - which is why the _other_ set of murder-for-hire charges in NY were dropped in 2014 before the trial...

It would be a prosecutor's nightmare to try a case where you have several of the principal investigators stealing funds, money-laundering, tampering with witnesses, selling internal info to the suspect, and who knows what else (we still don't know who scammed Ulbricht for the other hits, and Variety Jones has claimed that at least one more dirty cop is still on the loose). And let's not forget that FBI agent Tarbell, who 'found' the SR1 server in Iceland, beat a very hasty retreat to the private sector after what should've been a career- defining triumph, and no one wants to discuss exactly what bug supposedly spat out the IP address... I once asked a pair of FBI agents what was up with Tarbell leaving so fast, and they looked uncomfortable and didn't reply. (This is part of why Ulbricht's defense team's decision to not claim the Iceland server is widely regarded as a trial-losing mistake.)

Not only would there be little point, but any trial would likely be hugely embarrassing and discovery reveal things that the FBI and IRS and DEA would very much prefer be forgotten.

<comment><USER9> > no one wants to discuss exactly what bug supposedly spat out the IP address

I haven't really followed this case too closely, so what exactly are you hinting at here? That the government possibly used NSA / national-security- level exploits to figure out who DPR was? That there was some level of parallel construction / evidence laundering?

<comment><USER8> The DEA does use parallel-construction, and the FBI does recruit computer security researchers for attacks (the CMU CERT attack on SR2) and hand-me-down NSA exploits (and against Tor specifically), so neither of those is remotely far-fetched. And SR1 was a priority target.

We may never know what really happened; the whole Bridges/Force corruption thing, for example, is so wild no one could have dreamed it up.

However, from the descriptions like Nick Bilton's article/book puffpiece, I think it's somewhat likely (and more probable than NSA tech) that Tarbell did some unauthorized (and likely illegal) personal hacking and that's the kernel of truth behind his BS 'I was just typing in some random stuff and the server spat out an IP address at me!' story - SR1 was not very securely coded. Had this come out, it would've led to some serious evidence-tainting problems for the prosecutors because it affects everything downstream: the Iceland server, the SF IP address, the Pennsylvania backups, and finally Ross's unencrypted laptop in SF.

<comment><USER10> Parrallel re construction should be out lawed. How the heck do you defend against a lie after the fact. You could never challenge using the fruits of a poisonous tree method. Dirty dirty federal government move.

<comment><USER11> > Parrallel re construction should be out lawed.

Parallel construction is, by definition, illegal (it's covering up illegal behavior in order to introduce evidence in court illegally). The trouble is that it's difficult to identify and prove.

<comment><USER10> Yet this is exactly what they preach... smh

[https://www.muckrock.com/news/archives/2014/feb/03/dea- paral...](https://www.muckrock.com/news/archives/2014/feb/03/dea-parallel- construction-guides/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> So it is a double life sentence for nonviolent crimes. Isn't it a little ridiculous?

<comment><AUTHOR> I wouldn't call it nonviolent. He caused several deaths (and that they could/would/might have died otherwise without his involvement doesn't absolve him).

Not to speak of the murders he paid for, but that were thankfully stopped in the stage where it's still only an attempt.

<comment><USER13> Sorry, how did he cause several deaths?

<comment><AUTHOR> You can look up the articles and the HN commentary yourself. In short: he supplied drugs to people who then died of those drugs.

(Long version: he ran a platform where people sold the victims drugs, from which sales he financially profited). Victims who subsequently died.

I assume you think that they would have overdosed from other peoples' drugs anyway, but as I wrote, I don't accept that, so we can probably not discuss this productively.

<comment><USER14> This is absurd. Does Walgreens "cause death" every time someone ODs on Tylenol? Or your local Ford dealer when someone gets in a car accident? Smoking killed 6.6X the number of people drugs did in 2017—do you think we should start arresting everyone who owns a 7/11?

<comment><USER15> To carry forth the analogy, if I sell a handgun to a known felon, and they kill someone, did I "cause death"?

Presumably illegal substances are illegal in part based on risk, so even participating in the transaction you're assuming that risk.

<comment><USER16> You're talking about selling things that enable violent crimes against others, while the person you're responding to is taking about selling benign things with which one can only harm oneself. They seem categorically different.

<comment><USER15> I sell a gun to someone who has expressed to me interest in self harm. They commit suicide. Did I "cause death"?

<comment><USER17> You would be complicit fault is infinitely divisible.

<comment><USER18> Does fault need to divide, or can it apply severally?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Somewhat related, if you use the BOP inmate locator, he's doing max security time at a place with total communication control where the most violent and high risk inmates are sent in order to earn back rights to re-enter gen population. Average time spent there is 2 yrs.

</comment><comment><USER20> I wonder if the case would have played out differently if Silk Road hadn't coincided with the rise of synthetic drugs.

<comment><USER21> Roughly 25% of all opioid overdoses in the US are from government prescribed Methadone, which is essentially synthetic heroin.

[https://www.drugabuse.gov/related-topics/trends- statistics/o...](https://www.drugabuse.gov/related-topics/trends- statistics/overdose-death-rates)

<comment><USER22> Your statistic is not apparent in the linked information.

<comment><USER23> You're right, and the actual statistic is slightly different: "Despite this decline, however, methadone continues to account for nearly one in four prescription opioid-related deaths", [https://www.cdc.gov/mmwr/volumes/66/wr/mm6612a2.htm](https://www.cdc.gov/mmwr/volumes/66/wr/mm6612a2.htm) That is, not _all_ opioid-related deaths, but _prescription_ opioid-related deaths.

<comment><USER22> Ah, thanks for the clarification. I had assumed that methadone was a safe alternative.

So, are there solid studies on how mortality compares per-capita, per-usage duration?

<comment><USER24> Methadone seems like a very dangerous drug to use outside of a controlled clinical setting. Terrifying that variance of dosage between users (~18x) is greater than theraputic index (12x) - meaning a dose that is ineffectively low for one person can be an overdose for a another.

"Methadone, an opioid analgesic, is used clinically in pain therapy as well as for substitution therapy in opioid addiction. It has a large interindividual variability in response and a narrow therapeutic index. Genetic polymorphisms in genes coding for methadone-metabolizing enzymes, transporter proteins (p-glycoprotein; P-gp), and mu-opioid receptors may explain part of the observed interindividual variation in the pharmacokinetics and pharmacodynamics of methadone. Cytochrome P450 (CYP) 3A4 and 2B6 have been identified as the main CYP isoforms involved in methadone metabolism. Methadone is a P-gp substrate, and, although there are inconsistent reports, ABCB1 genetic polymorphisms also contribute slightly to the interindividual variability of methadone kinetics and influence dose requirements. Genetic polymorphism is the cause of high interindividual variability of methadone blood concentrations for a given dose; for example, in order to obtain methadone plasma concentrations of 250 ng/mL, doses of racemic methadone as low as 55 mg/day or as high as 921 mg/day can be required in a 70-kg patient without any co-medication."

Li Y et al; Mol Diagn Ther 12 (2): 109-24 (2008)

</comment></comment></comment></comment></comment></comment><comment><USER25> > Perry said if the president does not act according to the resolution, the > country needs to elect a Libertarian president in 2020 to get Ulbricht > pardoned.

Yes. Clearly, that is the single-most important issue in the 2020 presidential election.</comment>